systemd - systemd

	Commit message (Collapse)	Author	Age	Files	Lines
*	bpf: make bpf_devices_apply_policy() independent of any unit code	Zbigniew Jędrzejewski-Szmek	2019-11-11	1	-3/+8
\|
*	core: also split out helper to handle static device nodes	Zbigniew Jędrzejewski-Szmek	2019-11-10	1	-0/+1
\|
*	core: move bpf devices implementation to bpf-devices.[ch] and rename	Zbigniew Jędrzejewski-Szmek	2019-11-10	1	-7/+5
\| \| \| \| \| \| \| \| \| \| \|	The naming of the functions was a complete mess: the most specific functions which don't know anything about cgroups had "cgroup_" prefix, while more general functions which took a node path and a cgroup for reporting had no prefix. Let's use "bpf_devices_" for the latter group, and "bpf_prog_*" for the rest. The main goal of this move is to split the implementation from the calling code and add unit tests in a later patch.
*	bpf: refactor how we create device major:minor whitelists	Zbigniew Jędrzejewski-Szmek	2019-11-10	1	-3/+3
\| \| \| \|	No functional change intended except for minor adjustments to error messages.
*	cgroups: beef up DeviceAllow= syntax a bit	Lennart Poettering	2018-11-29	1	-0/+1
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Previously we'd allow pattern expressions such as "char-input" to match all input devices. Internally, this would look up the right major to test in /proc/devices. With this commit the syntax is slightly extended: - "char-" can be used to match any kind of character device, and similar "block-. This expression would work previously already, but instead of actually installing a wildcard match it would install many individual matches for everything listed in /proc/devices. - "char-<MAJOR>" with "<MAJOR>" being a numerical parameter works now too. This allows clients to install whitelist items by specifying the major directly. The main reason to add these is to provide limited compat support for clients that for some reason contain whitelists with major/minor numbers (such as OCI containers).
*	core: support cgroup v2 device controller	Roman Gushchin	2018-10-09	1	-0/+16
	Cgroup v2 provides the eBPF-based device controller, which isn't currently supported by systemd. This commit aims to provide such support. There are no user-visible changes, just the device policy and whitelist start working if cgroup v2 is used.